A stored cross‑site scripting flaw allows an attacker to inject malicious JavaScript that is persisted in the HT Contact Form 7 plugin’s data. When users view the stored content, the script executes in the browser context, enabling defacement, cookie theft, session hijack, or redirection of visitors. The vulnerability originates from inadequate neutralization of input during web page generation, as defined by CWE‑79.

HT Plugins’ HT Contact Form 7 plugin for WordPress versions up to and including 1.2.1. This includes installations that have not yet updated past the 1.2.1 release.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS is below 1% and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation activity so far. The likely attack vector involves normal use of the contact‑form widget: an unauthenticated visitor can submit data that the plugin stores, thereby inserting the malicious payload. An attacker does not need privileged access, making the risk readily exploitable for anyone who can submit form data.